TYPO3 CMS File Abstraction Layer Broken Access Control Vulnerability

A broken access control vulnerability has been identified in the File Abstraction Layer of TYPO3 CMS. Non-privileged backend users with file mount access could perform destructive write operations, such as moving, deleting, or renaming folders that represent the root of an active file mount. This issue arises from inadequate authorization restrictions and affects TYPO3 CMS versions prior to 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.

Impact

Exploitation of this vulnerability allows non-privileged users to manipulate folders on active file mounts, potentially leading to data loss or disruption of file management processes.

Remediation

Users are advised to update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, or 14.3.3 LTS, all of which address this vulnerability.